@bongos/core 1.19.1031 → 1.19.1033

package/tests/db_backup_offsite.mjs

@@ -0,0 +1,81 @@
+// tests/db_backup_offsite.mjs — the weekly offsite copy sizes what it ships the same way
+// on every platform (task 1004170).
+//
+// THE BUG. db-backup-offsite.sh read both of its sizes — the local dump it picks and the
+// ciphertext it uploads — with GNU-only `stat -c '%s'`, which BSD/macOS stat refuses
+// outright. Every run on a Mac died before it encrypted anything, and CI's Linux never
+// saw it, because nothing ran the script at all. The empty-ciphertext guard rides on the
+// second of those sizes, so it is pinned here too.
+//
+// The script runs for real under macOS-shaped `stat` and `wc` (tests/helpers.mjs), with
+// stub `age` and `python3` first on PATH: nothing is encrypted, no bucket is touched and
+// no network is used.
+//
+// Run:  node --test tests/db_backup_offsite.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { macShapedTools } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'db-backup-offsite.sh');
+const skip = process.platform === 'win32' ? 'needs a POSIX bash + coreutils (runs in CI)' : false;
+// The script's env-var prefix, built rather than written — the same reason as in
+// tests/db_backup_nightly.mjs: the legacy-literal ratchet counts the spelled-out form.
+const ENV = 'gds_'.toUpperCase();
+
+const DUMP_NAME = 'smallproj-2026-09-20T000000Z.sql.gz';
+const DUMP = '--\n-- PostgreSQL database dump complete\n--\n';
+const CIPHER = 'age-encryption.org/v1\n-> X25519 stub\n';
+
+// `cipher` is what the stub age writes to its -o file. The stub python3 answers the
+// boto3 probe and, for the upload program, records the object key it was handed.
+function runOffsite({ cipher = CIPHER } = {}) {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'db-offsite-'));
+  const bin = path.join(tmp, 'bin');
+  const dir = path.join(tmp, 'backups');
+  const uploads = path.join(tmp, 'uploads.log');
+  fs.mkdirSync(bin);
+  fs.mkdirSync(dir);
+  macShapedTools(bin);
+  fs.writeFileSync(path.join(dir, DUMP_NAME), DUMP);
+  fs.writeFileSync(path.join(tmp, 'cipher'), cipher);
+  fs.writeFileSync(path.join(bin, 'age'),
+    `#!/bin/bash\nwhile [ $# -gt 0 ]; do [ "$1" = -o ] && out="$2"; shift; done\ncp "${path.join(tmp, 'cipher')}" "$out"\n`, { mode: 0o755 });
+  fs.writeFileSync(path.join(bin, 'python3'),
+    `#!/bin/bash\n[ "$1" = -c ] && exit 0\ncat > /dev/null\necho "$${ENV}OFFSITE_KEY" >> "${uploads}"\n`, { mode: 0o755 });
+  const r = spawnSync('bash', [SCRIPT], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${bin}:${process.env.PATH}`,
+      [`${ENV}BACKUP_DB`]: 'smallproj',
+      [`${ENV}BACKUP_DIR`]: dir,
+      [`${ENV}SPACES_ENV`]: path.join(tmp, 'no-such-spaces.env'),
+      [`${ENV}OFFSITE_AGE_RECIPIENT`]: 'age1stubrecipient',
+      SPACES_KEY: 'k', SPACES_SECRET: 's', SPACES_BUCKET: 'b', SPACES_REGION: 'r', SPACES_ENDPOINT: 'https://example.invalid',
+    },
+  });
+  const sent = fs.existsSync(uploads) ? fs.readFileSync(uploads, 'utf8').split('\n').filter(Boolean) : [];
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, sent };
+}
+
+test('it sizes the dump and its ciphertext on macOS as on Linux, then ships it (task 1004170)', { skip }, () => {
+  const r = runOffsite();
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, new RegExp(`\\(${Buffer.byteLength(DUMP)} bytes → ${Buffer.byteLength(CIPHER)} encrypted\\)`),
+    'both sizes are the real byte counts, unpadded');
+  assert.deepEqual(r.sent, [`gds-offsite/${DUMP_NAME}.age`]);
+});
+
+test('an empty ciphertext is refused, never uploaded as a backup', { skip }, () => {
+  const r = runOffsite({ cipher: '' });
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /encryption produced an empty file/);
+  assert.deepEqual(r.sent, [], 'nothing reached the bucket');
+});

package/tests/grade_diff_hash.mjs

@@ -5,8 +5,9 @@
 // Covers:
 //   1. diffHash / shouldReuseGrade  — pure helpers in ship.js (no git/network)
 //   2. db.applyGrade stores diff_hash — SQL-aware fakePool (NODE_ENV=test seam)
-//   3. db.getTaskGrade export exists and returns null for a nonexistent task
-//      (full integration requires a real DB; structural contract is asserted here)
+//   3. db.getTaskGrade — exported, returns null for a task with no grade, and
+//      lifts signals.issues to the top level without removing the nested key
+//      (task 1003490; driven through the NODE_ENV=test deps.pool seam)
 //
 // Run:  node tests/grade_diff_hash.mjs
 
@@ -210,6 +211,80 @@ await test('getTaskGrade is exported from lifecycle/db.js', () => {
   assert.equal(typeof db.getTaskGrade, 'function', 'getTaskGrade must be exported');
 });
 
+// task 1003490 — the issues LIFT (task 1003488's second half). task_grades has
+// no `issues` column, so applyGrade stores the findings under signals.issues;
+// getTaskGrade copies them to the top level so a reader that does not know that
+// storage detail still sees them. These drive the real function through the
+// deps.pool seam (honoured because NODE_ENV === 'test' above) with a fake row,
+// so dropping or inverting the lift turns this file red.
+function gradeRowPool(row) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      return { rows: row === undefined ? [] : [row] };
+    },
+  };
+}
+function storedGradeRow(signals) {
+  return {
+    diff_hash: 'abc123', passed: false, score: 4.5, threshold: 6,
+    grader_kind: 'subagent-panel', grader_version: 'v4.0',
+    rubric_scores: { functional_fidelity: 9, code_quality: 2 },
+    signals, notes_md: 'FAIL',
+  };
+}
+
+await test('getTaskGrade lifts signals.issues onto the returned row', async () => {
+  const stored = [
+    { severity: 'blocker', file: 'a.js', summary: 'breaks the build', worker: 'quality' },
+    { severity: 'nit', file: 'b.js', summary: 'naming', worker: 'narc' },
+  ];
+  const pool = gradeRowPool(storedGradeRow({ panel_outcome: 'fail', issues: stored }));
+  const grade = await db.getTaskGrade(42, { pool });
+  assert.deepEqual(grade.issues, stored, 'the stored findings appear at the top level');
+  assert.equal(pool.calls.length, 1, 'one read');
+  assert.match(pool.calls[0].sql, /FROM task_grades/);
+  assert.deepEqual(pool.calls[0].params, [42], 'keyed on the task id');
+});
+
+await test('getTaskGrade leaves signals.issues in place (the lift is additive)', async () => {
+  const stored = [{ severity: 'major', file: 'c.js', summary: 'unchecked input' }];
+  const grade = await db.getTaskGrade(42, {
+    pool: gradeRowPool(storedGradeRow({ panel_outcome: 'fail', issue_count: 1, issues: stored })),
+  });
+  assert.deepEqual(grade.signals.issues, stored, 'signals.issues is still there for readers of the nested key');
+  assert.equal(grade.signals.panel_outcome, 'fail', 'the rest of signals is untouched');
+  assert.equal(grade.signals.issue_count, 1);
+  assert.equal(grade.score, 4.5, 'the row columns ride through unchanged');
+  assert.deepEqual(grade.rubric_scores, { functional_fidelity: 9, code_quality: 2 });
+});
+
+await test('getTaskGrade yields issues: [] (not undefined) when signals carries no issues', async () => {
+  const grade = await db.getTaskGrade(42, { pool: gradeRowPool(storedGradeRow({ panel_outcome: 'pass' })) });
+  assert.ok(Array.isArray(grade.issues), `issues must be an array, got ${typeof grade.issues}`);
+  assert.deepEqual(grade.issues, []);
+});
+
+await test('getTaskGrade yields issues: [] when signals itself is null', async () => {
+  const grade = await db.getTaskGrade(42, { pool: gradeRowPool(storedGradeRow(null)) });
+  assert.deepEqual(grade.issues, []);
+  assert.equal(grade.signals, null, 'a null signals column is passed through, not invented');
+});
+
+for (const [label, malformed] of [['a string', 'blocker: it is broken'], ['null', null], ['an object', { severity: 'blocker' }]]) {
+  await test(`getTaskGrade yields issues: [] when signals.issues is ${label}`, async () => {
+    const grade = await db.getTaskGrade(42, { pool: gradeRowPool(storedGradeRow({ issues: malformed })) });
+    assert.deepEqual(grade.issues, [], 'a malformed stored value never reaches the top level');
+    assert.deepEqual(grade.signals.issues, malformed, 'and the nested key is still left exactly as stored');
+  });
+}
+
+await test('getTaskGrade returns null when the task has no grade row', async () => {
+  assert.equal(await db.getTaskGrade(42, { pool: gradeRowPool(undefined) }), null);
+});
+
 // ======================================================================
 // Summary
 // ======================================================================

package/tests/hall_records.mjs

@@ -0,0 +1,85 @@
+// tests/hall_records.mjs — the hall's page records live one file per family (task 1003499).
+//
+// WHY. modules/hall-ui/CLAUDE.md used to carry every page family's "**The X landed
+// next (task N)**" record, each appended immediately above the same heading. So every
+// concurrent hall task inserted at the SAME line and collided with every other one —
+// the file needed five hand-resolved merges in September 2026 alone, and each new
+// record made the next collision likelier. Git cannot conflict on two branches that
+// each ADD a file, so the records moved to modules/hall-ui/records/, one per family,
+// and CLAUDE.md keeps a pointer. This pins the convention, so the next record lands
+// as a file rather than as a fifteenth section of the one file every hall task edits.
+//
+// Run:  node tests/hall_records.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const DOC = path.join(ROOT, 'modules/hall-ui/CLAUDE.md');
+const DIR = path.join(ROOT, 'modules/hall-ui/records');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const doc = fs.readFileSync(DOC, 'utf8').replace(/\r\n/g, '\n');
+const records = fs.existsSync(DIR) ? fs.readdirSync(DIR).filter((f) => f.endsWith('.md')).sort() : [];
+
+// The shape every record took: a bold lead-in naming a page family and saying it
+// "landed" (first / next / last / at / on). Anchored to a line start so prose that
+// merely uses the word stays legal.
+const RECORD_LEAD = /^\*\*(?:The|THE)\b[^*\n]*\blanded\b/gm;
+
+test('the hall doc carries no page record of its own', () => {
+  const leads = doc.match(RECORD_LEAD) || [];
+  assert.deepEqual(leads, [],
+    'a page record was added to modules/hall-ui/CLAUDE.md — give it its own file in modules/hall-ui/records/ instead (task 1003499)');
+});
+
+test('the hall doc points at the records, and says a new one is a new file', () => {
+  const at = doc.indexOf('### Page records');
+  assert.ok(at > 0, 'the "### Page records" pointer is gone, so nothing tells an agent the records exist');
+  const pointer = doc.slice(at, doc.indexOf('\n### ', at + 1));
+  assert.match(pointer, /\]\(records\/\)/, 'the pointer links the records directory');
+  assert.match(pointer, /head -n 1 modules\/hall-ui\/records\/\*\.md/, 'and says how to find the record for a page');
+  assert.match(pointer, /adds a NEW file/, 'and says a new record is a new file, not a new section here');
+});
+
+test('the records directory holds the records', () => {
+  assert.ok(records.length >= 11, `expected the moved records in modules/hall-ui/records/, found ${records.length}`);
+});
+
+test('every record opens with a one-line title naming its pages and its task', () => {
+  // `head -n 1 records/*.md` is the index — there is deliberately no hand-kept list,
+  // because a list every record appends to would be the same collision in a new place.
+  for (const f of records) {
+    const text = fs.readFileSync(path.join(DIR, f), 'utf8').replace(/\r\n/g, '\n');
+    const [first, blank, ...rest] = text.split('\n');
+    assert.match(first, /^# \S/, `${f}: line 1 must be the "# " title that head -n 1 lists`);
+    assert.match(first, /\btasks? \d{7}\b/, `${f}: the title names the task(s) the record belongs to`);
+    assert.equal(blank, '', `${f}: a blank line follows the title`);
+    assert.ok(rest.join('\n').trim().length > 200, `${f}: the record has a body`);
+    assert.equal((text.match(/^# /gm) || []).length, 1, `${f}: one title per file — a second one is a second record`);
+  }
+});
+
+test('every relative link in a record resolves from records/', () => {
+  // records/ sits one folder below CLAUDE.md, so a section copied out of it with its
+  // `../../docs/...` links intact points one level short — the trap this move met.
+  for (const f of records) {
+    const text = fs.readFileSync(path.join(DIR, f), 'utf8');
+    for (const [, href] of text.matchAll(/\]\(([^)\s]+)\)/g)) {
+      if (/^(?:[a-z]+:|#|\/)/i.test(href)) continue;
+      const target = path.resolve(DIR, href.split('#')[0]);
+      assert.ok(fs.existsSync(target), `${f}: link ${href} resolves to nothing (${path.relative(ROOT, target)})`);
+    }
+  }
+});
+
+console.log(`\nhall page records (task 1003499) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;

package/tests/helpers.mjs

@@ -987,3 +987,28 @@ export function namesFieldKey(src, key) {
     || new RegExp(`\\.${k}\\b`).test(src)
     || new RegExp(`=\\s*${k}\\b`).test(src);
 }
+
+// macShapedTools — write BSD/macOS-shaped `stat` and `wc` into binDir, for a shell
+// script under test to meet first on PATH (task 1004170).
+//
+// The backup scripts died on every Mac builder's machine and passed on CI's Linux, so
+// the red was invisible to anyone reading Actions. These bring the two differences to
+// any platform: BSD stat refuses GNU's `-c` outright, and BSD wc pads the number it
+// prints ("      11"). Only the stdin forms the scripts use are modelled (`wc -c < f`,
+// `... | wc -l`); any stat call other than `-c` fails loudly rather than pretend to be
+// BSD. Shared because both backup suites need the same pair.
+export function macShapedTools(binDir) {
+  const realWc = execFileSync('bash', ['-c', 'command -v wc'], { encoding: 'utf8' }).trim();
+  fs.writeFileSync(path.join(binDir, 'stat'), [
+    '#!/bin/bash',
+    'if [ "$1" = -c ]; then echo "stat: illegal option -- c" >&2; exit 1; fi',
+    'echo "macShapedTools: only the -c refusal is modelled, not BSD stat itself" >&2; exit 1',
+    '',
+  ].join('\n'), { mode: 0o755 });
+  fs.writeFileSync(path.join(binDir, 'wc'), [
+    '#!/bin/bash',
+    `n=$("${realWc}" "$@") || exit $?`,
+    'printf "%8s\\n" "${n//[[:space:]]/}"',
+    '',
+  ].join('\n'), { mode: 0o755 });
+}

package/tests/instance_db_migrated_on_code_move.mjs

@@ -24,6 +24,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { upgradeInvocation } from '../scripts/gds/provision-core-upgrade.js';
 import { migrateCmd, standaloneMigrateCmd, dbName } from '../scripts/gds/provision-repo.js';
+import { CORE_MIGRATE_SCRIPT } from '../scripts/gds/upgrade-migrate.js';
+import { INSTANCE_MIGRATE_SCRIPT } from '../scripts/gds/init.js';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const tenant = { slug: 'charter', db_name: 'charter_db', hosting_shape: 'co-tenant', port: 3107, status: 'active' };
@@ -35,7 +37,12 @@ test('bongos upgrade migrates before it restarts, and only --skip-migrate opts o
   assert.ok(migrate > 0, 'the upgrade flow runs migrate');
   assert.ok(restart > migrate, 'the restart that makes new code live comes AFTER migrate');
   assert.match(src.slice(migrate - 200, migrate), /if \(!opts\.skipMigrate\)/, 'the only way past migrate is the explicit flag');
-  assert.match(src, /run\('npm', \['run', 'migrate'\]/, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
+  // WHICH command is upgrade-migrate.js's call (task 1004274): the instance's declared script,
+  // else the one a scaffold declares — the core migrate.sh either way, so an adopted project with
+  // no scripts is migrated rather than rolled back. tests/upgrade_migrate.mjs exercises both.
+  assert.match(src, /function runMigrate\([^)]*\) \{\n\s*const \{ cmd, args, env \} = require\('\.\/upgrade-migrate'\)\.migratePlan\(instanceDir\)/,
+    'the migrate step spawns what migratePlan decides');
+  assert.equal(`bash ${CORE_MIGRATE_SCRIPT}`, INSTANCE_MIGRATE_SCRIPT, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
 });
 
 test('the control-plane runner targets the instance database, not its own', () => {

package/tests/plain_cards.mjs

@@ -167,7 +167,7 @@ test('the sign-in printers, the release refusals and the claim guard each print
     'scripts/gds/cli-lib.js': ['session_invalid', 'no_session'],
     'scripts/gds/release.js': ['no_active_claim', 'CLAIM_SESSION_MISMATCH'],
     'scripts/gds/claim.js': ['main_checkout_claim'],
-    'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked'],
+    'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked', 'merge_conflict'], // merge_conflict: task 1003499
     'scripts/gds/push-path-brief.js': ['no_push_credential'],
   };
   for (const [file, codes] of Object.entries(wired)) {

package/tests/redteam_patrol.mjs

@@ -83,7 +83,7 @@ test('disposition: red is reserved for findings that could not be recorded', ()
   // A dry run prints; it never claims to have filed, so it never fails.
   assert.deepEqual(p.disposition({ findingClasses: 3, doFile: false, blocker: null }),
     { action: 'dry-run', exitCode: 0 });
-  // Findings filed for adjudication = the patrol working as designed (ADR 0162).
+  // Findings filed for adjudication = the patrol working as designed (ADR 0158 §2).
   // If this ever became a failure, a weekly red would train everyone to ignore it.
   assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: null }),
     { action: 'file', exitCode: 0 });